CVE-2007-1507

The default configuration in OpenAFS 1.4.x before 1.4.4 and 1.5.x before 1.5.17 supports setuid programs within the local cell, which might allow attackers to gain privileges by spoofing a response to an AFS cache manager FetchStatus request, and setting setuid and root ownership for files in the cache.

Link	Resource
http://www.openafs.org/pipermail/openafs-announce/2007/000185.html	Vendor Advisory
http://www.openafs.org/pipermail/openafs-announce/2007/000186.html	Patch Vendor Advisory
http://www.openafs.org/pipermail/openafs-announce/2007/000187.html
http://www.debian.org/security/2007/dsa-1271	Vendor Advisory
http://www.securityfocus.com/bid/23060
http://www.securitytracker.com/id?1017807
http://secunia.com/advisories/24582	Vendor Advisory
http://secunia.com/advisories/24599	Vendor Advisory
http://secunia.com/advisories/24607	Vendor Advisory
http://security.gentoo.org/glsa/glsa-200704-03.xml
http://secunia.com/advisories/24720
http://www.mandriva.com/security/advisories?name=MDKSA-2007:066
http://www.vupen.com/english/advisories/2007/1033	Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/33180

Configuration 1

cpe:2.3:a:openafs:openafs:1.4.4:*:*:*:*:*:*:* cpe:2.3:a:openafs:openafs:1.4.3:*:*:*:*:*:*:* cpe:2.3:a:openafs:openafs:1.4.0:*:*:*:*:*:*:* cpe:2.3:a:openafs:openafs:1.5.6:*:*:*:*:*:*:* cpe:2.3:a:openafs:openafs:1.4.2:*:*:*:*:*:*:* cpe:2.3:a:openafs:openafs:1.5.13:*:*:*:*:*:*:* cpe:2.3:a:openafs:openafs:1.5.3:*:*:*:*:*:*:* cpe:2.3:a:openafs:openafs:1.5.5:*:*:*:*:*:*:* cpe:2.3:a:openafs:openafs:1.5.12:*:*:*:*:*:*:* cpe:2.3:a:openafs:openafs:1.5.1:*:*:*:*:*:*:* cpe:2.3:a:openafs:openafs:1.5.15:*:*:*:*:*:*:* cpe:2.3:a:openafs:openafs:1.5.8:*:*:*:*:*:*:* cpe:2.3:a:openafs:openafs:1.5.16:*:*:*:*:*:*:* cpe:2.3:a:openafs:openafs:1.5.14:*:*:*:*:*:*:* cpe:2.3:a:openafs:openafs:1.5.9:*:*:*:*:*:*:* cpe:2.3:a:openafs:openafs:1.5.10:*:*:*:*:*:*:* cpe:2.3:a:openafs:openafs:1.5.0:*:*:*:*:*:*:* cpe:2.3:a:openafs:openafs:1.5.2:*:*:*:*:*:*:* cpe:2.3:a:openafs:openafs:1.4.1:*:*:*:*:*:*:* cpe:2.3:a:openafs:openafs:1.5.11:*:*:*:*:*:*:* cpe:2.3:a:openafs:openafs:1.5.7:*:*:*:*:*:*:*

---

Published : 2007-03-20 10:19

Updated : 2017-07-29 01:30

---

NVD link : CVE-2007-1507

Mitre link : CVE-2007-1507

No products.

CWE-16